get_security_events_tool

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are supplied, so the description carries full burden. It states the output is grouped, implying some aggregation, but does not clarify read-only nature, authentication needs, rate limits, or error behavior. The description is not misleading but is severely under-specified for behavioral disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with the purpose. No fluff, immediate clarity. The constraint is stated last, but the whole description is under 30 words. Perfectly concise.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the existence of an output schema (though not shown here), the description adequately covers the main context for a simple read tool: what it returns (grouped events) and a key usage constraint. It does not address default behavior when neither zone parameter is given, but for a security events tool this is a minor gap. Overall sufficient for typical use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already covers all parameters with descriptions (100% coverage). The description adds value by explicitly stating the mutual exclusivity of zone_id and zone_name, which is not encoded in the schema. This goes beyond schema documentation and helps avoid misuse.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool fetches security/firewall events, specifies the grouping (by action and source), and is distinct from sibling tools which handle DNS, rules, cache, etc. The verb 'get' plus resource 'security/firewall events' is specific and unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides an explicit constraint: 'Provide either zone_id or zone_name, not both.' This is valuable usage guidance. However, it does not mention when to prefer this tool over alternatives (though siblings are clearly different domains) or what happens when no zone is provided. It still offers clear direction for parameter selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.